Github reporting a high severity security issue with simple-get

I am getting a high severity security issue from simple-get. As far as I can work out it comes from tedious use of @azure/identity which is currently shown in your package.json as v 1.5.2

npm does show a v2 of this package, although it appears to have breaking changes,

[michaelpinnell]

curious as to the timeline of releasing a new version of tedious with this bump in it

[clshortfuse]

FYI, the security vulnerability doesn’t actually effect tedious because it doesn’t actually use keytar. That’s only for @azure/identity when using VisualStudioCodeCredential.

https://github.com/Azure/azure-sdk-for-js/blob/%40azure/identity_1.5.1/sdk/identity/identity/src/credentials/visualStudioCodeCredential.ts#L13

That said, it’s also an optional dependency in @azure/identity, so if you want to go in and remove it manually from package-lock.json, you can. Or you can use this in package.json.

  "overrides": {
    "tedious": {
      "@azure/identity": "^2.0.1"
    }
  },

That said, it seems the vulnerability no longer lists tedious. npm audit now lists:

node_modules/simple-get
  prebuild-install  <=6.1.4
  Depends on vulnerable versions of simple-get
  node_modules/prebuild-install
    keytar  4.2.0 - 4.3.1 || 4.4.1 - 7.0.0 || 7.2.0 - 7.7.0
    Depends on vulnerable versions of prebuild-install
    node_modules/keytar

Which can be resolve with npm audit fix without affecting tedious.